Director, Security & Compliance

MHC is a global provider of AI-powered SaaS solutions for document, communication, and payment automation - purpose-built for highly regulated industries.

We simplify complexity and unlock intelligence so organizations can deliver exceptional experiences with confidence.

Our platform helps enterprise and mid-market organizations improve efficiency, ensure compliance, and modernize customer communications tomers use MHC solutions to generate more than 10 billion documents and process billions in AP payments annually. Recognized as a Leader in multiple G2 reports and featured in analyst reports from Gartner, IDC, Aspire, and Aragon, MHC is built for organizations that can't afford to get it wrong.

People are at the center of everything we do - for our customers and within our own walls. MHC supports a flexible, work-where-you-live model, and for five consecutive years has been named one of Minnesota's Top Workplaces by the Star Tribune, based entirely on employee feedback. We are a team driven to grow, committed to being better than yesterday, and stronger together.

We earn trust every day with our customers, our partners, and each other. We experiment boldly, and when our customers win, we win.

We are seeking a hands-on Director, Security and Compliance to build and own our security, data governance, and AI governance program as we scale. This is a rare "own it end to end" role. You won't be managing a large team or inheriting a mature GRC function. You'll be the single point of accountability for keeping customer trust, data, and AI systems secure and audit-ready, while working shoulder to shoulder with engineering, product, and sales.

This role sits at the intersection of three disciplines that are converging fast in AI-native companies: security compliance (SOC 2 and beyond), data governance, and AI governance/risk. You'll set the strategy and also do the work writing policies, running access reviews, managing auditors, and answering enterprise security questionnaires. This is also a certification-critical role. Maintaining our SOC 2 Type II report is a top-priority.

• Own the renewal and continuous operation of our SOC 2 Type II report and serve as primary liaison to our audit firm
• Mature the existing control environment: reduce manual evidence collection, tighten scope as new products/systems come online, and keep controls audit-ready year-round rather than sprinting before each renewal
• Develop, document, and operate controls that maximize risk mitigation and remain compliant with our target regulatory frameworks (SOC 2 Type II, HIPAA, PCI, GDPR/CCPA), and work directly with auditors to ensure ongoing compliance
• Expand our attestation footprint as needed based on customer and market demand (ISO 27001, HIPAA, GDPR/CCPA, or SOC 2 + additional Trust Services Criteria like Privacy)
• Serve as the primary point of contact for customer security reviews, questionnaires, and due-diligence requests during the sales cycle
• Maintain the company's security policy suite, risk register, and incident response plan; run tabletop exercises

• Establish data classification, retention, and access-control standards across production systems, data warehouses, and SaaS tools
• Partner with engineering to implement least-privilege access, encryption standards, and data lifecycle management
• Develop and implement secure software development lifecycle (SDLC) policies in partnership with engineering, along with environmental and physical security standards
• Own vendor/third-party risk management, including security review of new SaaS and AI tools before adoption
• Assist Legal with customer and vendor contractual negotiations…